pentestcode

PentestCode is a terminal based AI agent built to carry out authorized penetration testing engagements, meaning simulated attacks that security teams run against their own systems to find weaknesses before real attackers do. A user gives it a target and a goal in plain language, and it runs security tools, reads the results, updates its understanding of the network, and decides on its own what to try next, similar to how a human tester would work through an engagement. It began as a fork of a coding assistant project called OpenCode, with the code editing parts removed and replaced with offensive security capabilities.

Instead of one AI model doing everything, the system splits the work across 13 specialized agents that run in parallel, each with its own instructions and set of allowed tools. One lead agent plans the engagement and hands out tasks to others focused on reconnaissance, scanning, finding entry points, identity and Active Directory attacks, web application testing, and reporting. All of these agents read from and write to one shared memory of the engagement, so a finding made by one agent, such as an open port, is immediately visible to the others. This shared state tracks discovered hosts, vulnerabilities, stolen credentials, gained access, and relationships between all of these, and it persists between sessions so a user can close the terminal and pick up later where they left off.

The project ships 18 built in tools for parsing the output of common security scanners into this shared state, plus 19 optional knowledge packs covering specific services and attack playbooks that load only when needed. It works with more than 20 different AI providers, including Anthropic and OpenAI, through a common library. Installing it is a single command that downloads a self-contained binary with no separate runtime needed, and the README describes it as beta software intended for real engagements and practice environments like capture the flag competitions.